Malware Analysis Report

2025-08-05 16:53

Sample ID 250127-skhnhstrcy
Target JaffaCakes118_40dadb31be99c854573769b3141c156f
SHA256 e8bf17254e3a94cf7883caac0fbd2b534f7efc7544d239c12447094be56d5ab0
Tags
discovery persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e8bf17254e3a94cf7883caac0fbd2b534f7efc7544d239c12447094be56d5ab0

Threat Level: Shows suspicious behavior

The file JaffaCakes118_40dadb31be99c854573769b3141c156f was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

System Location Discovery: System Language Discovery

Browser Information Discovery

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer start page

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-27 15:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-27 15:10

Reported

2025-01-27 15:13

Platform

win7-20241010-en

Max time kernel

141s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\taskmgr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\Windows\\system\\taskmgr.exe" C:\Windows\system\taskmgr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\Windows\\system\\taskmgr.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\noteped.exe C:\Windows\system\taskmgr.exe N/A
File opened for modification C:\Windows\SysWOW64\noteped.exe C:\Windows\system\taskmgr.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
File opened for modification C:\Windows\system\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
File created C:\Windows\system\noteped.exe C:\Windows\system\taskmgr.exe N/A
File opened for modification C:\Windows\system\noteped.exe C:\Windows\system\taskmgr.exe N/A
File created C:\Windows\noteped.exe C:\Windows\system\taskmgr.exe N/A
File opened for modification C:\Windows\noteped.exe C:\Windows\system\taskmgr.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\system\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444152529" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03757d9cd70db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAC85DB1-DCC0-11EF-A723-5ADFF6BE2048} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b9412d6211fa8c48ababaa8ae4ad05fb00000000020000000000106600000001000020000000ca89ab9ca74de39e6f93a592d9c5aaf1eff1cad5e3957d04ad8e8b648a8c6097000000000e8000000002000020000000ddaaf75bf48f6e732b6ecc9940e3d55f471243126d65180a2c116e73f47c3a6820000000a2103140bbe295cca5ef50ef3fa77dc46556194755dc0a5a8c458c1618e92fb84000000049de100302b3c1bd580123e9e93ae79d731c3f8181317d1e1f57a9997753a0ca34bf5785d446fa2f95adf09621868685711503f214702c16f1b990ef8b34314f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b9412d6211fa8c48ababaa8ae4ad05fb0000000002000000000010660000000100002000000085a343cb30e89d4c968f5483ddb5660ff3c09b70e72322d0045b3c3cc55c5186000000000e800000000200002000000003743f3f174c10c59dc4d67b65d57990ad4858eff512ec1dc1ec60bcaace5f6d9000000065bfe34fe149659a0179a07ec48e3ed098165db2abe9ebd4f6ce077ef8a483b572eef003048d938120d6b8dc0aa91773808e0bd5d7c1f8ba78bd7c13c53470025c3d4cd68388392ed490a4ebb96d438ff6269bff67504f4ca350104d23c6ac44c95f518f976f0e930f66ece99856b817ee0cff5736526ccd373276f3d1ce5938f02c41b83dcc747bdd528d45b50a248f40000000ddfd48e72e23f74b30918ed50ebc0b75798044f1e6586f49af05b34b1e5f2e1e374847f8edbf9ab871bd782b766d6733c3607ac8ad8f7902ce08112e7f08fd30 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://mmsf.miwin.net" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://mmsf.miwin.net" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://mmsf.miwin.net" C:\Windows\system\taskmgr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://mmsf.miwin.net" C:\Windows\system\taskmgr.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "NOTEPED.EXE %1" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "NOTEPED.EXE %1" C:\Windows\system\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 576 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 576 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 576 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 576 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 576 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Windows\system\taskmgr.exe
PID 576 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Windows\system\taskmgr.exe
PID 576 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Windows\system\taskmgr.exe
PID 576 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Windows\system\taskmgr.exe
PID 3000 wrote to memory of 1648 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3000 wrote to memory of 1648 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3000 wrote to memory of 1648 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3000 wrote to memory of 1648 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://mmsf.miwin.net/

C:\Windows\system\taskmgr.exe

"C:\Windows\system\taskmgr.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 mmsf.miwin.net udp
US 8.8.8.8:53 mmsf.miwin.net udp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Windows\system\taskmgr.exe

MD5 40dadb31be99c854573769b3141c156f
SHA1 9e27f172a85337ca340120a26cdac1a74791276f
SHA256 e8bf17254e3a94cf7883caac0fbd2b534f7efc7544d239c12447094be56d5ab0
SHA512 562f98aecef901308fbb59bf510c09b1a01799f08865b194c09c42daae4b03cbeedbc7dedd03b85cf1844942372fa0d3599d196abb49b5b1cdfb454ec51b82aa

memory/576-12-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1172-22-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab8BEE.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar8C8D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e0dc99d548328dd5eb10ed4da5a1e6d
SHA1 15eed3901ddb4efecedd2868fd435d8d69509978
SHA256 735ec11a9a94112537aaf7980ee8016387acedeae873a0ac4030b5afeb1bf227
SHA512 6f7c5b9077ebf9dc66c9525aa89ff8e2ffd68fb87bff8dddaaf839bad4caa5664d53e682e91277de7bfd1c11addde0db7291e0e52fe22269adc707cab9d6c2d4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6661f3d831d243ce1d7c26f1adb81787
SHA1 becf44bed2f975beaae6bb2ca3ebf36c684034df
SHA256 4675905a778e6dcb1c89962f1d3b71bd66f8f3743c213582785be46e66d40f0f
SHA512 cc56a4f4773b957e8fc3be94a7832b3d47a9d06a68a99cbfbe3335701c6364a8a8a8a0db1112a433c37f90193df29a4784daed74ed937daf2b114fadc964bafd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6740557df68892cb4dc9e599b69a5229
SHA1 c393ff71d63b7a4562906a3d806f3533db177b7d
SHA256 955ccd97fd9d1296a766b74142533f181f5930f72fc0fc6f8706d943dd32c396
SHA512 7a8bb09b26039362228d8769647a77802fbf604b7b998b8f687302b83e56c9b47371eef12fae627761f871d6553da0542a71c1d149cc558a209bb1bd3467dbb7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 194481fc1e2019f23a43525f5fb9c608
SHA1 afe16e81cf04c05d05250dd35ff69b1c6289cf34
SHA256 4e7e27805596b046e6df9868499ca01d14087617816dc6c5be7d422fc411a101
SHA512 f959446299017b864360e551d257ceaf01c91df8a5fd7dbe63e90aca954da6634d497b3f782d45e263d1b36c70158451123399d22719d4b0eb0b84fa781a66ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f9a8901cd440174330fe811d20daef7e
SHA1 7b605fe90b133cd2acb436967a8dd8e3058a8ddc
SHA256 e90d156027e7b43888b2cb7755994044724cadd23f000ac2eafde961115a15f1
SHA512 be4421e18fb0f248d716b53139dcc9c632ab8fc403abd632fad1619816002d5860732b11a5840fee2e0d5bb8ba8278c1963b361b0dcbef4ce96a9bc60fabda6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9aa139a3e66aeafce2631b4d765eba3e
SHA1 5c4735d36256bf803bb4cba22566140689a616e0
SHA256 592f827e7620ea85fb510be4f2118170912c42432c373bbcd5c739a824a12e7e
SHA512 3c7f49575fd3a756d012314b76150dbfd1b010e30a39ec3aca294ad5eab9530016cf4ebe0d90bb9e0a18af4350fa8a6f39a93747bd0f7146b5d557d2ac21167b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 080c28f39320ce571a30adfa9fe91c04
SHA1 6c32e9f84d4cd73697c59be4341f4cfe9e954dc8
SHA256 950a84de359eda2800245cfa001b07bd488353b583044db39223d86eb0d078b4
SHA512 edd56f676877481fce0d0ca92f7f007678440a01a9aa8f1caeb004184f953f32cd11c6597bf583fb7415ef2106b8d43f2e41de8f30f133352503801e770d46cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e2fa83958fa29796e730747ae9d31b0a
SHA1 4c505c13439361f9815c0221bc3a93601f1f50f9
SHA256 ea98c5f5289c30a01cfc23003fbd7068ea710c6c5e671be758983686a3f11128
SHA512 7c7376fca4fe347d1d725ad3ff419e2d003414464c6249476fdaa8857c646bc4ee66ae2d4d76b7e7cbe3c8a384c2a10f8046308b36e1ae89866ecb0b639e3b5c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7a44b5e88e6ab506dd4d0a17b375fdb
SHA1 7e75b034d8d89a9975dec38e20b35bebbeacdaf8
SHA256 414bf6edc776da473eb2a794800eecc2aea37bce0ef42c55a8ada1e9b3b1cbf8
SHA512 96ea5f6236625cbaa4e8082ce3360f2ac2cae5977536a2547657c0bfd2c8ef3c5a596f792afbaf4103eb5bc9e458ed0c295b7be81fb875c513bb9270c2f1df2a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 37c84edc8163820ae858cfd17020e6e8
SHA1 35c852fd8f7cbd8615af19e0c2fbb3b9b7543f65
SHA256 1b82c03b8cfd3bb72edd19c1045a8853b8052dac41fa7253a054ee759d80604e
SHA512 30f5206da044a73c57e2c536ee9f3e713145b9745395d07d90c8668a1ef3654cfbdc401489ac8346116c811dc4a5c570006e64dc040d944fbce055973310d08a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1bce17e741e2f97531fff4004f180d91
SHA1 7b4064372a15a104496308e440ec14cc4f49f3e8
SHA256 8b74dc8b11d1f6091a52e3003bc664a37bb4e20a548f095a7370077fefdf4f44
SHA512 85ad040a52b2104108c9a9bff940cc29deb8d9c782709253a70a73a9ed587d944f83bb46226971ccfb611dc7d3fb809148492f8a85dc60ac196449cd3f18441e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b8e558f562c598ca2cdb5189390d112
SHA1 b1528a05296ce5e3eacb22945d7108ea257d217e
SHA256 086dd2a9644e1dfb63ea16829b9d1b7090c63a7d823c1c88cb7b5e3f29299969
SHA512 d1a56806a703e564f3bf3c7db09ea9947c91d9109e349be3961a19c77909689b1ee778b681d794568234d216af56361f157ab09a279e08f107e4ef109c81958f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 03698b8fa9207f9b462be7ff2dcca282
SHA1 96b0d3c35407805044d934b5f6c2bca641dc1699
SHA256 7741f73948d18cd7201616d430f07d7b358a77fd5855ce3776f2b8b01060ade7
SHA512 d5981ad80a008d8fc85041b1eb4dac72915d509954b4bc040375b899f5464381c56be658b0ec5dfcbf6f8f0eef32e76555c771d81668db4155c2c1f4193c4c76

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a57cb86fd2c19740796dcdfedc19b1c2
SHA1 8beac5cf7f1f862673369cc2fb84054b0dceee7c
SHA256 9e3c01f3a55e9dd48eaf97c32886ce6288a964ea376eeaf6bf18d6993504a3ba
SHA512 7fa5e8a7fc8c8d5523efa2275c1339a66c9ccdcfb0fa6bd2d05c6cd3f04b43eb45cb94b148d4adc3cd056042786131a5c324381c5a79e6b5c4da63ea39b65472

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3be26333cccc80ad76337849345aa14b
SHA1 b7f3b1564922903524685a633a8c38dadaf719b1
SHA256 16af51f0f500a2aaf9bd7f57cb26b45001a8de306fed7db42a1bbc8c3eea59ae
SHA512 61ff48be2cdfc7fc858ceee6c02e629cc66de714f82fadc428dcae41d6e4a99cdbb5b91b3b7616deb35bbc3b68f0fb19a41b821662f27a49ffc74d97a1772015

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2760a07221b8fde4b80bfcc2fb3ff30
SHA1 09925809a041a053b3e89715f9a9eb805c2d8b4a
SHA256 ceab0f85efcd1c2fcc1864dbef9d4420fffbbe46bc4dfdcbe170418cf8524f98
SHA512 e4286cd81a173d4bce855625fd03d82363ddffe7c01a1df46adcdab12fb6ac49a7766d761b34aff70e1bf5a6808e340723c0fe6b8f954a4f8bacd6fb2c215139

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46a0249e63f3d0e88ac080b3461b9abc
SHA1 2964ac3f091fc778cdb73fae1e67f89a50121b26
SHA256 38178bc3369aed01772d23e1a6a3ca661e6466c7412964145bc8d9b6728f4484
SHA512 aa21b66ba4a88fbf77940fca1f9cbc3a3d78977f27e27820c52fccf3a6634f2dc15f7bc9691af19148dde683b7fe2e458895fb9e7f5ac6fc99b166d89678f77a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0a864ce6d88fa0325ed9ea5cab01f9c9
SHA1 f3ee6283434cbbb3652548c8e12d4bbd7930ff52
SHA256 5dac37aa18d6730f178216514b0785625bd3fd2fca92bac656999f661ce6f3fa
SHA512 2bc24453d5736c4c762516a790119eb97c3e615c82e1f104d8bcadc594d1dd493284de63ad5034abb8f6a83398cf24f6f52b4bad3f9a2a98897c11bf3ec969d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e13233b05133056f88130493205d7c8
SHA1 f1d6f598ded99357a691e344d07802de31e3ccb3
SHA256 d537997d23816fe22e0e6f2b938c111f25a28b5a187b5dd4c715c57a77ba00ea
SHA512 6a0deba9c8def8a3ff286821a4d475fe95bcb2329655f378d5309ca8d62339b22661b98622f26fc7a563be6165103127f928f46b5d9de4c5d7de5d35ac8ae41f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 124e013dca991f9c0d49da6be12f547d
SHA1 57fbcba01d4fb02668c44fc508d8a5eaed0078b3
SHA256 a063b537cb2e5df4a9aac8e439a976de3bc5b983391ed38e65b631200a8b2683
SHA512 eb730d23fbfd51efca521706f6ea98921900a9df6903aa3e7b7472231bd952d4060870a71db7d61b0713629f73c3556b0770c21f4d2067b83cb2975c3e097934

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f8fdb748d3a962fb9247b463614725c8
SHA1 1bd0b0b7c1a7617960e4962d66366c3d25f6df58
SHA256 f94ca1f7b894a05df72d580a37168e0ea10acb1d12b321fbb10e00b481063653
SHA512 1e5a695efab0d9a05950244605c260716182f920bee8b2d1fd4ce6d529ebc898cfb65719f92bfd0f1d0f6b762361287c4bcedbdbcd82507fa000374bbbbc43f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3091b0ef0eff44661edb1e57de40c0d
SHA1 36404e9360fdb8f1464e0fd52faf86d54da2a8c1
SHA256 f1efbd7db1d8da87c93b820d65ea3d078ec42987cf9ed1e1711ad932e4fece8e
SHA512 873fc9186ec7899dff8673ad1d9aad0e3bda33b56da77551fee34b1aa0c3339f0baa230260a4ab42d49ddd86e8ca8684a6d5e36959f14199479231a4f37d1b54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fd1671989bb46d1428c1f23aaf95a5e3
SHA1 597a4ca90e53174cddca0064cc8ce389ef42c6c1
SHA256 2aa6ad2e79fba0061419bdc15bc2cf151b6a98a4c297a23a376bce854caab0bc
SHA512 d9589775bea0ba9ed2b1cd99f4d053f08cea2f50346fe1bd31b68758e77e93725af91cc48240c73d4e1e9236d8154620a3c2b74e13e82b4c51913de43ab7358a

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-27 15:10

Reported

2025-01-27 15:13

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\taskmgr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\Windows\\system\\taskmgr.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\Windows\\system\\taskmgr.exe" C:\Windows\system\taskmgr.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\noteped.exe C:\Windows\system\taskmgr.exe N/A
File opened for modification C:\Windows\SysWOW64\noteped.exe C:\Windows\system\taskmgr.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
File created C:\Windows\system\noteped.exe C:\Windows\system\taskmgr.exe N/A
File opened for modification C:\Windows\system\noteped.exe C:\Windows\system\taskmgr.exe N/A
File created C:\Windows\noteped.exe C:\Windows\system\taskmgr.exe N/A
File opened for modification C:\Windows\noteped.exe C:\Windows\system\taskmgr.exe N/A
File created C:\Windows\system\taskmgr.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\system\taskmgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://mmsf.miwin.net" C:\Windows\system\taskmgr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://mmsf.miwin.net" C:\Windows\system\taskmgr.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://mmsf.miwin.net" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://mmsf.miwin.net" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "NOTEPED.EXE %1" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "NOTEPED.EXE %1" C:\Windows\system\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe N/A
N/A N/A C:\Windows\system\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4180 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4180 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 3544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 3544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4180 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Windows\system\taskmgr.exe
PID 4180 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Windows\system\taskmgr.exe
PID 4180 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe C:\Windows\system\taskmgr.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 2980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 2980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3896 wrote to memory of 4652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dadb31be99c854573769b3141c156f.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mmsf.miwin.net/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a4b946f8,0x7ff9a4b94708,0x7ff9a4b94718

C:\Windows\system\taskmgr.exe

"C:\Windows\system\taskmgr.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,669846392436632736,11341062249754883385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3972 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 mmsf.miwin.net udp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
CN 140.143.196.199:80 mmsf.miwin.net tcp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp

Files

C:\Windows\System\taskmgr.exe

MD5 40dadb31be99c854573769b3141c156f
SHA1 9e27f172a85337ca340120a26cdac1a74791276f
SHA256 e8bf17254e3a94cf7883caac0fbd2b534f7efc7544d239c12447094be56d5ab0
SHA512 562f98aecef901308fbb59bf510c09b1a01799f08865b194c09c42daae4b03cbeedbc7dedd03b85cf1844942372fa0d3599d196abb49b5b1cdfb454ec51b82aa

memory/4180-14-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

\??\pipe\LOCAL\crashpad_3896_PMABZGGECLCDNRVG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 232d58c76bf18060210dad667d99c4c3
SHA1 7f007231df190205624c2b242c51abca2a989b68
SHA256 a24783a65c25e7b725958f4182450a12461b44de0b8f095da3fb57bfad7ded28
SHA512 bd2daf90153f8c1ec1480b4b8ffa2d03c56374c0a5d775bdc425f45eed6f9d6276fa445e6bdc1effccba30909ad93c5b67cc1d4d8ded2233a1bbb9a4a787093b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d7a9d56-5b28-44b1-8576-b730648e80e8.tmp

MD5 09d0ab88a0a34732ec8766265f0c82a9
SHA1 d6fab54608b18ebbd96c499443c5b6a0e12713e1
SHA256 94032b8195cc39b990b6c9d3f9ae60607fd9ef88b2ccd31d3fde069ee29beddc
SHA512 c7f512c4b980e9ee5fe54de7b4df635eadd65424a8d2d63bcf75bf102455997c6efa362f642af88e1098e9de4fc0aef5d4fbb4ea4b4742282523e96088ca3d68

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 db069e92b68424bccb302e3290eb5457
SHA1 9c5074f1a1e8b0b0222cd8a65138134749edd4d7
SHA256 2cb475d444872c86ac5574904d28d9af4b7f3c655c6f052423b03c7485dd60b7
SHA512 d8bce3b297af5b529823ba4a09847dfc02f04ba738c02473a669fd3408214cf9314fd147f07673f873dd790101f54b03362458af3786b0c1672da33c4694f8f0

memory/4648-83-0x0000000000400000-0x0000000000410000-memory.dmp